Investigations with context
Help analysts review security signals, incidents, investigative notes, and reported activity in an organized workspace.
Microsoft Cloud Solution Provider partner resources
Make security operations a clearer conversation.
MKCS SIEM Intelligence gives organizations a customer-owned security workspace for guided source onboarding, operational visibility, threat investigation, incident workflows, and reporting. Help customers understand the value, evaluate their environment, and choose an appropriate Enterprise deployment.
Public positioning resources. This page does not provision accounts, authorize access to customer environments, or grant reseller rights.
SECURITY OPERATIONS Customer-owned
One workspaceVisibility · Investigation · Accountability
01ConnectAssess approved sources
02InvestigateReview security signals
03DocumentMaintain decision evidence
CentralizedSecurity operations
Customer-ledSource authorization
EnterpriseGuided onboarding
MarketplaceSubscription model
01 / Customer opportunity
Who is MKCS SIEM for?
Partners can start with the problems customers already recognize: scattered security information, limited investigation visibility, complex onboarding, and a need for clearer operational ownership.
Bring environments into the conversation
Discuss Azure, AWS, Google Cloud, and on-premises source requirements in one discovery process. Exact connector coverage and onboarding scope are confirmed per customer.
More accountable operations
Support reviewable incident workflows, access responsibilities, operational reporting, and evidence-oriented conversations.
02 / CSP positioning toolkit
How to describe the platform to buyers.
Use concise, supportable statements. Avoid promising specific connectors, certifications, detection rates, service levels, or a managed 24/7 SOC unless the relevant service has been separately verified and contracted.
MKCS SIEM Intelligence helps your security team organize monitoring and investigations in a customer-owned workspace, with guided integration and an enterprise commercial model.
Suggested short introduction for qualified customers
Customer discovery topics
- Which cloud and on-prem environments need review?
- Which log sources are authorized and in scope?
- Who owns alerts, incidents, escalation, and response?
- What ingestion volume and retention needs are expected?
- Which customer identity and billing organizations will participate?
- Does the customer require managed SOC services or software-only operations?
Guided source onboarding
Review customer requirements and approved permissions before enabling any security telemetry source.
SIEM workspace & SOC workflows
Security overview, event exploration, detections, alert operations, incidents, and investigation records.
Assurance & reporting
Keep collection state, evidence, operational actions, and customer access boundaries explainable.
03 / Enterprise commercial model
Simple base pricing with an ingestion allowance.
These are the publisher's standard Enterprise plan figures. A customer's actual purchase, invoice, eligibility, taxes, and any CSP commercial arrangements are governed by Microsoft Marketplace and applicable agreements.
MKCS SIEM Intelligence · Enterprise
$500USD / month base subscription
Includes the SIEM platform and 10 GB of monthly measured ingestion.
- Dedicated customer workspace and security operations tools
- Guided customer onboarding and authorized source review
- Incident and investigation workflows with reporting visibility
- Marketplace-aligned commercial enrollment
Additional ingestion
$300per additional started 5 GB block
Applies beyond the 10 GB included monthly allowance, using the approved ingestion measurement definition.
Partner margins, resale discounts, co-sell terms, regional availability, and promotional conditions are not specified on this public page. Discuss commercial terms with MarkoTek through approved channels.
04 / Partner-led customer journey
A straightforward, customer-authorized path.
Partners can coordinate discovery and the commercial conversation. MarkoTek validates the exact technical scope and purchased subscription before enabling customer use.
- 1
Discover
Identify customer environments, security objectives, ownership, and expected monthly ingestion.
- 2
Validate scope
Confirm supported data sources, customer permissions, integration and privacy requirements, and commercial availability.
- 3
Purchase & verify
Follow the appropriate Microsoft Marketplace purchasing process and verify the customer's subscription and authority.
- 4
Onboard
Provision or associate the authorized workspace; review customer access, event delivery, and operational readiness.
Existing customers: Commercial subscription association should not require reconnecting an already approved Azure log source. MarkoTek will validate the customer's existing workspace and applicable billing start separately.
05 / Practical questions
Common partner questions.
Is this a managed 24/7 SOC service?
No. MKCS SIEM is a software platform for customer-owned security operations. Managed monitoring or response commitments require a separate agreement.
Which data sources can the customer connect?
The integration conversation may cover Azure, AWS, Google Cloud, and on-premises systems. MarkoTek confirms the supported source types and provisioning steps for each engagement before making commitments.
Does a Marketplace purchase grant access to the customer's Azure subscription?
No. Customer source authorization and security operations access are separate from commercial purchasing and require their own approvals.
Can partners promise a reseller margin or entitlement?
No standard margin or reseller entitlement is published here. Eligibility and terms must be confirmed through the appropriate Microsoft CSP and MarkoTek processes.
Partner enablement
Start a customer security conversation.
For customer qualification, solution scoping, program questions, or authorized reseller engagement, connect with MarkoTek. We can review the account, sourcing requirements, and the appropriate purchasing path.